The Commissioner for Information of Public Importance and Personal Data Protection issued a decision ordering the Republic Geodetic Authority (RGA) to suspend personal data processing carried out in front offices by capturing video images of present citizens and broadcasting the video stream over the Internet (live streaming).
Prior to that, after carrying out the inquiry, the Commissioner issued a Warning to RGA, indicating that such data processing is unauthorized. RGA failed to act upon the Warning. It first announced through the media, and then informed the Commissioner that it "did not act contrary to the provisions of the Law on Personal Data Protection". On that occasion, the RGA, in addition to the purpose of processing indicated in the inquiry, "improving the business process", by informing citizens about the number of people and preventing crowds in the front offices, indicated another, which it failed to mention in the course of inquiry, "the realization of the objectives in the Action Plan for Implementation of the National Anti-Corruption Strategy".
The purpose of informing the citizens about the number of people present in the front office is debatable in itself, since the above videos show only the current state that changes from moment to moment. Based on that, a citizen can hardly reliably conclude what the situation will really be in the moment of his/her arrival. But quite apart from that, it is obvious that this kind of information can be provided in many ways, which much less impinge on the citizens' privacy, e.g. by publishing tonal or graphic information on the number of present people, and direct broadcasting of images of people or information about their real personal presence in space and time is fully disproportionate to the said purpose and that it exceeds the needs of achieving the purpose by far.
As regards the realization of some sort of anti-corruption goals, it is definitely quite unclear why live streaming should be used for this purpose in general, let alone be necessary. Particularly, because the RGA expressly stated in the course of the proceedings that "analytical processing of video recording of any kind is not being carried out".
"Interestingly", despite the claim that "it did not act contrary to the Law on Personal Data Protection" the RGA informed the Commissioner that after its Warning "it technically changed the quality of broadcasted video image, rendering persons physically unrecognizable now." However, subsequent inspection of the live streaming has found that personal identity can still be determined, in some cases it is quite clear, which means that said videos contain personal data, and therefore are necessarily subject to the general principles of processing prescribed by the Law on Personal Data Protection.
The Law on Personal Data Protection stipulates that data processing is not allowed if a natural person failed to give his/her consent to processing, i.e. if processing is carried out without legal authority (Article 8, item 1), or if the purpose of processing is vaguely defined (Article 8, item 3) or if the processing is disproportionate to the purpose (Article 8, item 7), therefore, according to the above, the data processing performed by the RGA is multitudinously contrary to the Law in this case.
Since the RGA proceeded with unlawful processing, despite the warning, the Commissioner issued a decision ordering discontinuation of processing.
On occasion of this particular case, the Commissioner warns that unauthorized processing of personal data via live streaming is gaining momentum, that in the near future several inquiries will be launched, and that it would be very good if all entities, who are doing this or planning to do it, understood the said decision as a useful warning.
